Penetration Tester – Cloud, Data & Agentic AI

About the role

XenonStack, a Data and AI foundry for agentic systems, is hiring a Penetration Tester for its Cybersecurity / Security Assurance / Agentic AI Security team in Dubai (DIFC), working from the office. The role covers enterprise and Dubai government customers and involves hands-on penetration testing of cloud, data, analytics and agentic AI platforms, including Kubernetes, APIs and identity systems.

Key responsibilities

• Perform black-box, grey-box and white-box penetration testing of applications, APIs, networks and cloud infrastructure, including authenticated and unauthenticated API testing against the OWASP API Security Top 10.
• Identify authentication bypasses, authorization weaknesses, privilege escalation, injection flaws, insecure configurations and sensitive data exposure.
• Test OAuth 2.0, OpenID Connect, JWT, RBAC, ABAC and service-to-service authentication; validate multi-tenant isolation and cross-tenant data controls.
• Build controlled, non-destructive proof-of-concept exploits and run manual tests beyond automated scanning.
• Test Azure and approved private clouds, Kubernetes clusters, container workloads, API gateways, ingress controllers, CI/CD pipelines and software supply chain.
• Assess data lakehouse and analytics platforms (Spark, Apache Iceberg, Trino, object storage) for data-access and encryption controls.
• Adversarially test LLM apps, AI agents and multi-agent workflows, including prompt injection, tool-output manipulation, MCP servers, agent gateways, RAG pipelines and ContextGraph access controls.
• Test agent discovery, shadow-agent detection, permission inheritance, approval gates and isolation between agent execution, monitoring and governance planes.
• Follow DESC Cyber Force program requirements, CREST-aligned practices and customer-approved methods, and prepare technical reports with findings, evidence and remediation recommendations.
• Retest vulnerabilities after fixes and verify that remediation does not introduce new weaknesses.

Required profile

• 5-10 years of hands-on experience in application security, API penetration testing, cloud infrastructure, Kubernetes and enterprise security assessments.
• DESC Cyber Force-recognized penetration-testing qualification at Team Member level, with verifiable Cyber Force program experience or eligibility for registration with an approved provider.
• Ability to work with customer Information Security, Security Operations and engineering teams.

Required skills

• OWASP API Security Top 10 and OAuth 2.0 / OpenID Connect / JWT / RBAC / ABAC testing
• Kubernetes and container security
• DESC Cyber Force and CREST-aligned penetration testing